SOURCES/0030-versionlock-Use-only-most-specif-NEVRA-RhBug-1961217.patch

@@ -0,0 +1,88 @@
+From ee0e1ca0751d29adcc4788334ce8fd74b4d772c9 Mon Sep 17 00:00:00 2001
+From: Marek Blaha <mblaha@redhat.com>
+Date: Wed, 19 May 2021 16:52:57 +0200
+Subject: [PATCH] versionlock: Store full NEVRA
+
+---
+ plugins/versionlock.py | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/plugins/versionlock.py b/plugins/versionlock.py
+index 77b7f91..8a3994e 100644
+--- a/plugins/versionlock.py
++++ b/plugins/versionlock.py
+@@ -312,5 +312,4 @@ def _match(ent, patterns):
+ 
+ def pkgtup2spec(name, arch, epoch, version, release):
+     # we ignore arch
+-    e = "" if epoch in (None, "") else "%s:" % epoch
+-    return "%s-%s%s-%s.*" % (name, e, version, release)
++    return "%s-%s:%s-%s.*" % (name, epoch or "0", version, release)
+-- 
+2.40.1
+
+
+From da25d50a8753b0a648a2653e2fb9e33eb372f73f Mon Sep 17 00:00:00 2001
+From: Marek Blaha <mblaha@redhat.com>
+Date: Wed, 19 May 2021 16:53:37 +0200
+Subject: [PATCH] versionlock: Use only the most specific NEVRA (RhBug:1961217)
+
+When matching patterns from versionlock.list file accept only the most
+specific possible NEVRA.
+The problem with current implementation (using of all possible variants)
+is following (also see the referenced bug):
+
+$ dnf repoquery procps-ng
+procps-ng-0:3.3.17-1.fc34.1.x86_64
+procps-ng-0:3.3.17-1.fc34.x86_64    <-- this one is installed
+
+See the `.1` minorbump part of the release after %{dist} in
+`procps-ng-0:3.3.17-1.fc34.1.x86_64`
+
+$ dnf versionlock procps-ng
+Adding versionlock on: procps-ng-0:3.3.17-1.fc34.*
+
+Now both of the available procps-ng version could be matched by this
+pattern:
+- procps-ng-0:3.3.17-1.fc34.x86_64 (when `*` is considered arch)
+- procps-ng-0:3.3.17-1.fc34.1.x86_64 (when `*` is matched against
+  release part, and arch is considered not present)
+
+That results in versionlock allowing upgrade to a newer version than the
+locked one.
+
+= changelog =
+msg:           Versionlock works correctly with packages with minorbump part of release
+type:          bugfix
+resolves:      https://bugzilla.redhat.com/show_bug.cgi?id=1961217
+---
+ plugins/versionlock.py | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/versionlock.py b/plugins/versionlock.py
+index 8a3994e..32c51da 100644
+--- a/plugins/versionlock.py
++++ b/plugins/versionlock.py
+@@ -89,7 +89,9 @@ class VersionLock(dnf.Plugin):
+                 pat = pat[1:]
+                 excl = 1
+ 
+-            possible_nevras = dnf.subject.Subject(pat).get_nevra_possibilities()
++            possible_nevras = dnf.subject.Subject(pat).get_nevra_possibilities(
++                forms=[hawkey.FORM_NEVRA, hawkey.FORM_NEVR, hawkey.FORM_NEV,
++                       hawkey.FORM_NA, hawkey.FORM_NAME])
+             if possible_nevras:
+                 count[excl] += 1
+             else:
+@@ -102,6 +104,8 @@ class VersionLock(dnf.Plugin):
+                 else:
+                     locked_names.add(nevra.name)
+                     locked_query = locked_query.union(pat_query)
++                if pat_query:
++                    break
+ 
+         if count[1]:
+             logger.debug(APPLY_EXCLUDE.format(locklist_fn, count[1]))
+-- 
+2.40.1
+

SOURCES/0031-Fix-boot-time-derivation-for-systems-with-no-rtc.patch

@@ -0,0 +1,55 @@
+From 23a6123348f0a387768ebdfdaaded900a083039e Mon Sep 17 00:00:00 2001
+From: Todd Lewis <todd_lewis@unc.edu>
+Date: Wed, 16 Nov 2022 10:45:39 -0500
+Subject: [PATCH] Fix boot time derivation for systems with no rtc
+
+That addresses https://bugzilla.redhat.com/show_bug.cgi?id=2137935
+---
+ plugins/needs_restarting.py | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/needs_restarting.py b/plugins/needs_restarting.py
+index 91dbe66..03831fa 100644
+--- a/plugins/needs_restarting.py
++++ b/plugins/needs_restarting.py
+@@ -34,6 +34,7 @@ import functools
+ import os
+ import re
+ import stat
++import time
+ 
+ 
+ # For which package updates we should recommend a reboot
+@@ -199,7 +200,28 @@ class ProcessStart(object):
+ 
+     @staticmethod
+     def get_boot_time():
+-        return int(os.stat('/proc/1').st_mtime)
++        """
++        We have two sources from which to derive the boot time. These values vary
++        depending on containerization, existence of a Real Time Clock, etc.
++        For our purposes we want the latest derived value.
++        - st_mtime of /proc/1
++             Reflects the time the first process was run after booting
++             This works for all known cases except machines without
++             a RTC - they awake at the start of the epoch.
++        - /proc/uptime
++             Seconds field of /proc/uptime subtracted from the current time
++             Works for machines without RTC iff the current time is reasonably correct.
++             Does not work on containers which share their kernel with the
++             host - there the host kernel uptime is returned
++        """
++
++        proc_1_boot_time = int(os.stat('/proc/1').st_mtime)
++        if os.path.isfile('/proc/uptime'):
++            with open('/proc/uptime', 'rb') as f:
++                uptime = f.readline().strip().split()[0].strip()
++                proc_uptime_boot_time = int(time.time() - float(uptime))
++                return max(proc_1_boot_time, proc_uptime_boot_time)
++        return proc_1_boot_time
+ 
+     @staticmethod
+     def get_sc_clk_tck():
+--
+libgit2 1.3.2
+

SOURCES/0032-Doc-update-for-reposync-RhBug-2132383-2182004.patch

@@ -0,0 +1,34 @@
+From a83af3db9f1aaf698be5455a01814849e39307d8 Mon Sep 17 00:00:00 2001
+From: Jaroslav Mracek <jmracek@redhat.com>
+Date: Mon, 27 Mar 2023 10:24:59 +0200
+Subject: [PATCH] Documentation update for reposync (RhBug:2132383,2182004)
+
+The update describe the behavior when `-n` and `--download-metadata`
+is used.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=2132383
+https://bugzilla.redhat.com/show_bug.cgi?id=2182004
+---
+ doc/reposync.rst | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/doc/reposync.rst b/doc/reposync.rst
+index 0df00b9..bbf714c 100644
+--- a/doc/reposync.rst
++++ b/doc/reposync.rst
+@@ -46,7 +46,11 @@ All general DNF options are accepted. Namely, the ``--repoid`` option can be use
+     Delete local packages no longer present in repository.
+ 
+ ``--download-metadata``
+-    Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c on it.
++    Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c
++    on it. When the option is used with `--newest-only`, only latest packages will be downloaded, but metadata will
++    still contain older packages. It might be useful to update metadata using `createrepo_c --update` to remove
++    the packages with missing RPM files from metadata. Otherwise, DNF ends with an error due to the missing files
++    whenever it tries to download older packages.
+ 
+ ``-g, --gpgcheck``
+     Remove packages that fail GPG signature checking after downloading. Exit code is ``1`` if at least one package was removed.
+--
+libgit2 1.3.2
+

SOURCES/0033-Add-fix-and-test-assertion-for-no-systemd-unit-exist.patch

@@ -0,0 +1,88 @@
+From b086bfe09cf0eec67ea830e0e0f3482c6b6b2aa9 Mon Sep 17 00:00:00 2001
+From: Andy Baugh <andy@troglodyne.net>
+Date: Fri, 28 Apr 2023 10:52:16 -0500
+Subject: [PATCH] Add fix and test assertion for "no systemd unit exists for
+ pid"
+
+= changelog =
+msg: Catch exception in needs-restarting.py when no systemd unit exists for pid
+type: bugfix
+resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2122587
+related: None
+---
+ plugins/needs_restarting.py    | 18 ++++++++++++++----
+ tests/test_needs_restarting.py | 15 +++++++++++++--
+ 2 files changed, 27 insertions(+), 6 deletions(-)
+
+diff --git a/plugins/needs_restarting.py b/plugins/needs_restarting.py
+index 03831fa..8dbc965 100644
+--- a/plugins/needs_restarting.py
++++ b/plugins/needs_restarting.py
+@@ -138,10 +138,20 @@ def get_service_dbus(pid):
+         systemd_manager_object,
+         'org.freedesktop.systemd1.Manager'
+     )
+-    service_proxy = bus.get_object(
+-        'org.freedesktop.systemd1',
+-        systemd_manager_interface.GetUnitByPID(pid)
+-    )
++    service_proxy = None
++    try:
++        service_proxy = bus.get_object(
++            'org.freedesktop.systemd1',
++            systemd_manager_interface.GetUnitByPID(pid)
++        )
++    except dbus.DBusException as e:
++        # There is no unit for the pid. Usually error is 'NoUnitForPid'.
++        # Considering what we do at the bottom (just return if not service)
++        # Then there's really no reason to exit here on that exception.
++        # Log what's happened then move on.
++        msg = str(e)
++        logger.warning("Failed to get systemd unit for PID {}: {}".format(pid, msg))
++        return
+     service_properties = dbus.Interface(
+         service_proxy, dbus_interface="org.freedesktop.DBus.Properties")
+     name = service_properties.Get(
+diff --git a/tests/test_needs_restarting.py b/tests/test_needs_restarting.py
+index 0ad70a5..7b629b4 100644
+--- a/tests/test_needs_restarting.py
++++ b/tests/test_needs_restarting.py
+@@ -20,6 +20,8 @@ from __future__ import absolute_import
+ from __future__ import print_function
+ from __future__ import unicode_literals
+ 
++from unittest.mock import patch, Mock
++import dbus
+ import needs_restarting
+ import tests.support
+ 
+@@ -29,8 +31,6 @@ MM_FILE = '7fc4e1168000-7fc4e1169000 rw-s 1096dd000 00:05 7749' \
+           '                      /dev/dri/card0'
+ SO_FILE = '30efe06000-30efe07000 r--p 00006000 08:02 139936' \
+           '                         /usr/lib64/libSM.so.6.0.1'
+-
+-
+ class NeedsRestartingTest(tests.support.TestCase):
+     def test_smap2opened_file(self):
+         func = needs_restarting.smap2opened_file
+@@ -46,6 +46,17 @@ class NeedsRestartingTest(tests.support.TestCase):
+         self.assertTrue(ofile.deleted)
+         self.assertEqual(ofile.name, '/usr/lib64/libXfont.so.1.4.1;5408628d')
+ 
++    def test_get_service_dbus_nounitforpid(self):
++        func = needs_restarting.get_service_dbus
++        # So, This is gonna look kinda screwy unless you are aware of what
++        # this proxies interface is actually doing. The GetUnitByPid function
++        # is normally "dynamically" defined by the get_dbus_method at runtime.
++        # As such there's no actual way to mock it out in any meaningful way
++        # without create=True.
++        with patch( "dbus.proxies.Interface.GetUnitByPID", create=True, side_effect=dbus.DBusException('org.freedesktop.systemd1.NoUnitForPID: PID 1234 does not belong to any loaded unit.') ), \
++             patch( "dbus.SystemBus", return_value=Mock(spec=dbus.Bus) ), \
++             patch( "dbus.bus.BusConnection.__new__", side_effect=dbus.DBusException("Never should hit this exception if mock above works")):
++                 self.assertIsNone(func(1234))
+ 
+ class OpenedFileTest(tests.support.TestCase):
+     def test_presumed_name(self):
+-- 
+2.40.1
+

SOURCES/0034-Fix-zlib-reboot-requirement-RhBug-2092033.patch

@@ -0,0 +1,51 @@
+From b5e6219b12773b76f634641752fa6f194608e1ff Mon Sep 17 00:00:00 2001
+From: Nicola Sella <nsella@redhat.com>
+Date: Wed, 21 Jun 2023 15:21:57 +0200
+Subject: [PATCH] Fix zlib reboot requirement (RhBug:2092033)
+
+---
+ plugins/needs_restarting.py | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/needs_restarting.py b/plugins/needs_restarting.py
+index 8dbc965..3197fe1 100644
+--- a/plugins/needs_restarting.py
++++ b/plugins/needs_restarting.py
+@@ -42,6 +42,8 @@ import time
+ NEED_REBOOT = ['kernel', 'kernel-rt', 'glibc', 'linux-firmware',
+                'systemd', 'dbus', 'dbus-broker', 'dbus-daemon']
+ 
++NEED_REBOOT_DEPENDS_ON_DBUS = ['zlib']
++
+ def get_options_from_dir(filepath, base):
+     """
+     Provide filepath as string if single dir or list of strings
+@@ -277,15 +279,24 @@ class NeedsRestartingCommand(dnf.cli.Command):
+         NEED_REBOOT.extend(opt)
+         if self.opts.reboothint:
+             need_reboot = set()
++            need_reboot_depends_on_dbus = set()
+             installed = self.base.sack.query().installed()
+             for pkg in installed.filter(name=NEED_REBOOT):
+                 if pkg.installtime > process_start.boot_time:
+                     need_reboot.add(pkg.name)
+-            if need_reboot:
++
++            dbus_installed = installed.filter(name=['dbus', 'dbus-daemon', 'dbus-broker'])
++            if len(dbus_installed) != 0:
++                for pkg in installed.filter(name=NEED_REBOOT_DEPENDS_ON_DBUS):
++                    if pkg.installtime > process_start.boot_time:
++                        need_reboot_depends_on_dbus.add(pkg.name)
++            if need_reboot or need_reboot_depends_on_dbus:
+                 print(_('Core libraries or services have been updated '
+                         'since boot-up:'))
+                 for name in sorted(need_reboot):
+                     print('  * %s' % name)
++                for name in sorted(need_reboot_depends_on_dbus):
++                    print('  * %s (dependency of dbus. Recommending reboot of dbus)' % name)
+                 print()
+                 print(_('Reboot is required to fully utilize these updates.'))
+                 print(_('More information:'),
+-- 
+2.40.1
+

SOURCES/0035-Fix-for-issue-with-binary-garbage-in-smaps-files.patch

@@ -0,0 +1,75 @@
+From 1a29f3ab2f4719f40510dc08f12f4795ad358e93 Mon Sep 17 00:00:00 2001
+From: Andy Baugh <thomas.baugh@cpanel.net>
+Date: Tue, 6 Jun 2023 16:37:42 +0000
+Subject: [PATCH] Fix for strange issue with binary garbage in smaps files
+
+= changelog =
+msg: Avoid issue with garbage smaps chars in needs-restarting.py
+type: bugfix
+resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2212953
+related: None
+---
+ plugins/needs_restarting.py    |  2 +-
+ tests/test_needs_restarting.py | 14 +++++++++++++-
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/plugins/needs_restarting.py b/plugins/needs_restarting.py
+index 3197fe1..64d4d0f 100644
+--- a/plugins/needs_restarting.py
++++ b/plugins/needs_restarting.py
+@@ -76,7 +76,7 @@ def list_opened_files(uid):
+         try:
+             if uid is not None and uid != owner_uid(smaps):
+                 continue
+-            with open(smaps, 'r') as smaps_file:
++            with open(smaps, 'r', errors='replace') as smaps_file:
+                 lines = smaps_file.readlines()
+         except EnvironmentError:
+             logger.warning("Failed to read PID %d's smaps.", pid)
+diff --git a/tests/test_needs_restarting.py b/tests/test_needs_restarting.py
+index 7b629b4..d7dd6d5 100644
+--- a/tests/test_needs_restarting.py
++++ b/tests/test_needs_restarting.py
+@@ -1,3 +1,4 @@
++# coding: utf-8
+ # Copyright (C) 2014 Red Hat, Inc.
+ #
+ # This copyrighted material is made available to anyone wishing to use,
+@@ -15,15 +16,15 @@
+ # Red Hat, Inc.
+ #
+ 
+-
+ from __future__ import absolute_import
+ from __future__ import print_function
+ from __future__ import unicode_literals
+ 
+ from unittest.mock import patch, Mock
+ import dbus
+ import needs_restarting
+ import tests.support
++import tempfile
+ 
+ DEL_FILE = '3dcf000000-3dcf032000 r-xp 00000000 08:02 140759                ' \
+            '         /usr/lib64/libXfont.so.1.4.1;5408628d (deleted)'
+@@ -58,6 +59,17 @@ class NeedsRestartingTest(tests.support.TestCase):
+              patch( "dbus.bus.BusConnection.__new__", side_effect=dbus.DBusException("Never should hit this exception if mock above works")):
+                  self.assertIsNone(func(1234))
+ 
++    def test_list_opened_files_garbage_filename(self):
++        tempObj = tempfile.NamedTemporaryFile()
++        tempFile = tempObj.name
++        with open(tempFile, 'wb') as bogusFile:
++            bogusFile.write(b'151e7f7b7000-151e7f7b8000 r--p 00006000 fd:01 14744                      /usr/lib64/lib\xe5Evil-13.37.so')
++        smaps = [[1234,tempObj.name]]
++        with patch("needs_restarting.list_smaps", return_value=smaps):
++            ofiles = list(needs_restarting.list_opened_files(None));
++            self.assertEqual(ofiles[0].presumed_name, '/usr/lib64/lib<69>Evil-13.37.so')
++
++
+ class OpenedFileTest(tests.support.TestCase):
+     def test_presumed_name(self):
+         ofile = needs_restarting.OpenedFile(
+--
+libgit2 1.6.4
+

SOURCES/0036-needs-restarting-Add-microcode_ctl-to-a-reboot-list.patch

@@ -0,0 +1,40 @@
+From e1af3642a7811229567284f6901d393a6ce28b62 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Thu, 23 Nov 2023 16:26:06 +0100
+Subject: [PATCH] needs-restarting: Add microcode_ctl to a reboot list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 9f46488c6b1ac553989a3fd8a9ea18271451c5e8 upstream.
+
+To fully update CPU microcode, a reboot is needed because the
+microcode update should be applied before starting a kernel and other
+process.
+
+Therefore recommend a reboot after installing or updating
+microcode_ctl package.
+
+https://issues.redhat.com/browse/RHEL-17356
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ plugins/needs_restarting.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/needs_restarting.py b/plugins/needs_restarting.py
+index 64d4d0f..92cde0a 100644
+--- a/plugins/needs_restarting.py
++++ b/plugins/needs_restarting.py
+@@ -40,7 +40,8 @@ import time
+ # For which package updates we should recommend a reboot
+ # Mostly taken from https://access.redhat.com/solutions/27943
+ NEED_REBOOT = ['kernel', 'kernel-rt', 'glibc', 'linux-firmware',
+-               'systemd', 'dbus', 'dbus-broker', 'dbus-daemon']
++               'systemd', 'dbus', 'dbus-broker', 'dbus-daemon',
++               'microcode_ctl']
+ 
+ NEED_REBOOT_DEPENDS_ON_DBUS = ['zlib']
+ 
+-- 
+2.43.0
+

SPECS/dnf-plugins-core.spec

@@ -34,7 +34,7 @@
 
 Name:           dnf-plugins-core
 Version:        4.0.21
-Release:        19%{?dist}
+Release:        25%{?dist}
 Summary:        Core Plugins for DNF
 License:        GPLv2+
 URL:            https://github.com/rpm-software-management/dnf-plugins-core
@@ -68,6 +68,13 @@ Patch26:        0026-Add-a-warning-when-using-system-upgrade-on-RHEL.patch
 Patch27:        0027-offline-upgrade-Add-security-filters.patch
 Patch28:        0028-system-upgrade-Show-warning-always-for-a-downstream.patch
 Patch29:        0029-Update-translations.patch
+Patch30:        0030-versionlock-Use-only-most-specif-NEVRA-RhBug-1961217.patch
+Patch31:        0031-Fix-boot-time-derivation-for-systems-with-no-rtc.patch
+Patch32:        0032-Doc-update-for-reposync-RhBug-2132383-2182004.patch
+Patch33:        0033-Add-fix-and-test-assertion-for-no-systemd-unit-exist.patch
+Patch34:        0034-Fix-zlib-reboot-requirement-RhBug-2092033.patch
+Patch35:        0035-Fix-for-issue-with-binary-garbage-in-smaps-files.patch
+Patch36:        0036-needs-restarting-Add-microcode_ctl-to-a-reboot-list.patch
 
 
 BuildArch:      noarch
@@ -844,6 +851,27 @@ ln -sf %{_mandir}/man1/%{yum_utils_subpackage_name}.1.gz %{buildroot}%{_mandir}/
 %endif
 
 %changelog
+* Mon Jan 15 2024 Petr Pisar <ppisar@redhat.com> - 4.0.21-25
+- Add microcode_ctl to a reboot list (RHEL-17356)
+
+* Mon Oct 16 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.0.21-24
+- Fix for strange issue with binary garbage in smaps files (RHEL-6392, RhBug:2212953)
+
+* Tue Jun 27 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.0.21-23
+- Add patch: Fix zlib reboot requirement (RhBug:2092033)
+
+* Wed May 31 2023 Nicola Sella <nsella@redhat.com> - 4.0.21-22
+- Add fix and test assertion for "no systemd unit exists for pid"
+
+* Fri May 19 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.0.21-21
+- Remove patch: "reposync: Implement --safe-write-path option (RhBug:1898089,2203766)" (RhBug:2208444)
+
+* Wed May 17 2023 Jaroslav Rohel <jrohel@redhat.com> - 4.0.21-20
+- versionlock: Use only the most specific NEVRA (RhBug:1961217)
+- Fix boot time derivation for systems with no rtc (RhBug:2166444,2182157)
+- Doc update for reposync (RhBug:2132383,2182004)
+- reposync: Implement --safe-write-path option (RhBug:1898089,2203766)
+
 * Wed Mar 08 2023 Marek Blaha <mblaha@redhat.com> - 4.0.21-19
 - Update translations